BlueLane provides patch management safety net

PatchPoint appliance protects servers by patching applications on the network wire

Last week a client of mine applied the latest OS patches to its main Microsoft Windows Server 2003 server. It rebooted and kaboom! No workstations could connect to the server. After uninstalling all the patches, it began communicating again.

I have many clients afraid to apply Microsoft patches to their servers because of similar experiences. Oracle, and many other major vendors, have had to re-release patches to fix vendor-induced bugs. So should you apply the patches quickly to beat the hackers to the punch, or risk waiting a few weeks to let the vendor work out all the bugs?

Enter Blue Lane Technologies’ PatchPoint appliances. The PatchPoint family is an inline patching proxy. Essentially, administrators can forgo or delay installing OS and common application patches on Windows, Linux, and Solaris servers; instead, patches are “applied” on the network packet stream. Each incoming network packet headed for a protected server is statefully inspected for exploit code. The incoming packet can then be “patched” to make the exploit benign, log it and raise an alert, or drop the involved session.

It’s a unique level of flexibility not found in most IPSes. Although Blue Lane doesn’t recommend putting off a vendor patch forever, it does give the administrator a more flexible deployment schedule. Think of it as Tivo for patches.

Protect and prevent
I reviewed the PatchPoint G/450 (Release 2.7-G256 code) gateway, a 2U box with four Gigabit 10/100/1000 Ethernet ports spread equally over two segments, plus redundant power supplies and fans. A separate, required PatchPoint M/10 management appliance manages anywhere from one to 100 PatchPoint G/450 gateways.

The PatchPoint gateway device sits inline between the untrusted network domains and the servers to be protected. Initial IP configuration is done using an out-of-band serial DB-9 session. Afterward, the PatchPoint gateway can be set to auto-discover all the server computers on a particular subnet. It discovered all the servers on my test network except one, a Microsoft ISA firewall server. This was because the ISA didn’t respond to the auto-discovery ICMP and TCP echo tests. Administrators will have to add non-responding servers manually, as they already have to do with most auto-discovery tools.

After it locates the servers, PatchPoint uses active fingerprinting and passive network traffic listening to find server services that need patching. I was impressed with how many services it found and how well it fingerprinted the services, not to mention that the gateway located and correctly identified all the dynamic RPC ports. In a few cases, I had to manually help the gateway decide between various patch levels, but overall it did a great job by itself.

One other caveat -- the gateway looks at the common default ports and many other lower numbered ports during auto-discovery. Services running on high non-default ports, such as RDP running on 43389, were not located automatically and would have to be added manually.

After the services are discovered and identified, the administrator can apply protection to all of them at once or pick and choose. The default action can be set to Apply Fix (make exploits benign), Log and Alarm, or Drop Sessions. PatchPoint comes with a handful or two of pre-canned, graphic chart-style reports, but more detailed data can be downloaded to Microsoft Excel or CSV file.

I used the Metasploit Framework and Core Impact vulnerability scanners to test PatchPoint. In every case, the exploit was stopped and logged.

According to Blue Lane, the G/450 appliance does fast 2.4 Gbps wirespeed forwarding. Apache protection proxies are handled at speeds as fast as 1.4Gbps, with the slowest proxy, SMTP, coming in at 700Mbps. This speed is accomplished using an intelligent inspection engine that quickly filters out non-threatening traffic so that only the most suspect traffic is run through the upper layer inspection proxies.

We don’t need no stinkin’ patches
Blue Lane has an excellent vulnerability testing laboratory, and the PatchPoint appliances include protection against dozens of non-publicly released exploits along with more than a dozen other common vulnerabilities, such as SQL inject, fragmentation attacks, excessive requests, etc. They even have a file extension blacklist and can filter outgoing HTTP requests against a whitelist to protect servers when the administrator decides to browse to untrusted Web sites.

What PatchPoint claims to do (protect servers against patched OS and common application threats), it does well. However, it is important to understand what PatchPoint doesn’t do: It doesn’t protect workstations. I wish it could patch client side applications like Internet Explorer, Firefox, Adobe Acrobat, and Macromedia Flash. Blue Lane, there’s a new market just awaiting your arrival.

Click for larger view.

Second, it doesn’t protect against all exploits, usually just the patched ones, and only the vendors and products that Blue Lane monitors. Blue Lane does track exploits and patch releases, test vulnerabilities, and then use that information to update the appliances so they’ll have the most up-to-date patch information. Their long watch list includes Oracle, Exchange, Apache, IIS, Sendmail, IMAP, FTP, MS-SQL, MySQL, and many other common applications, but it cannot protect you against the myriad of exploits outside the realm of patching, such as password guessing, network sniffing, and so on.

Nevertheless, I was impressed with what Blue Lane has accomplished so far. Its patch proxies are highly effective, and even if it doesn’t cover every threat out there, PatchPoint certainly eliminates enough risk to be valuable. I highly recommend it to companies with 20 or more servers who are at moderate or high risk of external attack and sweating the diminishing patching thresholds.

InfoWorld Scorecard
Value (10.0%)
Effectiveness (30.0%)
Ease of use (20.0%)
Setup (10.0%)
Reporting (10.0%)
Management (20.0%)
Overall Score (100%)
BlueLane PatchPoint G/450 8.0 9.0 9.0 9.0 7.0 9.0 8.7